Automated Mirroring And Remote Switch Port Analyzer (RSPAN)/ Encapsulated Remote Switch Port Analyzer (ERSPAN) Functions Using Fabric Attach (FA) Signaling

ABSTRACT

A method and apparatus for automated mirroring is presented. In a particular embodiment of a method for automated mirroring, a Network Device running as a Fabric Attach (FA) Server receives an FA Type Length Value (TLV) from an Access Device running as a FA proxy or client. The Access Device is configured to mirror traffic to a Remote Switch Port Analyzer (RSPAN) Virtual Local Area Network (VLAN). The TLV includes a request to associate the RSPAN VLAN with a Service Identifier (I-SID) used to carry mirror traffic in a network. The method includes wherein the FA server receives the mirrored traffic on the RSPAN VLAN. The FA Server signals the I-SID into the network, and detects receive interest in the I-SID. The FA Server delivers the mirrored traffic to devices that expressed a receive interest in the mirrored traffic.

CROSS REFERENCE TO RELATED APPLICATIONS

The present application is related to the patent application having anAttorney Docket Number of AVA15-05, filed on the same day as the presentapplication, and which is incorporated herein by reference in itsentirety.

BACKGROUND

Data stream mirroring provides a duplication of a stream of data packetsto an alternate destination in addition to a primary destination.Mirroring may be employed for debugging and diagnoses of network trafficanomalies, security and surveillance, and as a failover or redundancypath for critical data. Mirroring involves identification of a sourcestream, typically designated as a router port and optionally withfiltering to restrict particular source or destination addresses, forexample. The mirroring setup also designates a mirroring destination asthe recipient of the mirrored stream, resulting in a duplicate packetfor each packet in the identified source stream.

Remote Switch Port Analyzer (RSPAN) and Encapsulated Remote Switch PortAnalyzer (ERSPAN) are efficient, high performance traffic monitoringsystems. They duplicate network traffic to one or more monitorinterfaces as it transverse a switch. While the term RSPAN is usedthroughout the application, it should be appreciated that ERSPAN couldalso be used and the terms are used interchangeably throughout. RSPAN isused for troubleshooting connectivity issues and calculating networkutilization and performance, among many others. RSPAN allows a user tomonitor traffic from source ports distributed over multiple switches.RSPAN works by mirroring the traffic from the source ports of an RSPANsession onto a Virtual Local Area Network (VLAN) that is dedicated forthe RSPAN session. This VLAN is then trunked to other switches, allowingthe RSPAN session traffic to be transported across multiple switches. Onthe switch that contains the destination port for the session, trafficfrom the RSPAN session VLAN is simply mirrored out the destination port.ERSPAN brings Generic Routing Encapsulation (GRE) for all capturedtraffic and allows it to be extended across Layer 3 domains.

Fabric Attach (FA) is an enhanced implementation of Shortest PathBridging (SPB)) technology that simplified operations through accesslayer only network provisioning. FA delivers a “Zero-Touch-Core” thatvirtually eliminates the chance of core network misconfiguration. Itallows simple and secure deployment for any type of network servicewithout the need to make any configuration changes on intermediate/corenodes, even in environments where clients roam. These same benefits arealso available to network elements or hosts that are not SPB-capable.Any FA capable device (a switch, server, Access Point (AP), InternetProtocol (IP) Phone, etc.) can be securely connected to the network, beauthorized for a network service, and attach to the appropriate networkservice instance—all automatically and based on policy. This enablesFabric Attach devices to come straight out of the box and onto thenetwork with “Zero Touch”.

SUMMARY

Mirroring is a commonly supported mechanism in networking equipment.Mirroring means sending a copy of a traffic stream to one or moreadditional mirror destinations in addition to the normal packetprocessing actions that are performed on that traffic stream. It is usedfor supporting applications like traffic monitoring and analysis. It isalso sometimes use for troubleshooting problems in a network.

Configurations herein are based, in part, on the observation thatmechanisms for managing the configuration of remote mirroring arecumbersome and most often require the configuration of multiple networkelements (switches, routers, etc.) for each stream of traffic that needsto be mirrored. Unfortunately, conventional arrangements suffer from theshortcoming that multiple configuration actions need occur at multiplelocations depending on the location of the routing entities(routers/switches, etc.) designated as the source of the mirrored streamand the destination recipients of the mirrored stream. Disablingmirroring likewise requires a reversal of these actions or unnecessarybandwidth remains allocated to mirroring activities. Accordingly,configurations herein substantially overcome the above describedshortcomings by use of FA signaling to provide dynamic control of mirrortraffic.

Generally mirroring supports one or more of the following. LocalMirroring is where a mirror destination is a local port or a group oflocal ports on the device. RSPAN is where a mirror destination is aVirtual Local Area Network (VLAN). Mirrored traffic then flows along thetopology of the VLAN. ERSPAN is where mirrored traffic is encapsulatedin an Internet Protocol (IP) Tunnel (typically GRE encapsulation) andsent to the destination IP address of the tunnel.

What is missing overall is an easy way for a network element to requestthat some traffic from it be mirrored or for a monitoringstation/application to request that a certain mirrored traffic bedelivered to it, and further should be deployed in such a fashion thatthe traffic gets mirrored only when a listening applications is deployedand connected to the network. Once the application goes offline, thenmirroring should stop.

Note that each of the different features, techniques, configurations,etc. discussed in this disclosure can be executed independently or incombination. Accordingly, the present invention can be embodied andviewed in many different ways. Also, note that this summary sectionherein does not specify every embodiment and/or incrementally novelaspect of the present disclosure or claimed invention. Instead, thissummary only provides a preliminary discussion of different embodimentsand corresponding points of novelty over conventional techniques. Foradditional details, elements, and/or possible perspectives(permutations) of the invention, the reader is directed to the DetailedDescription section and corresponding figures of the present disclosureas further discussed below.

In a particular embodiment of a method for automated mirroring, aNetwork Device running as a Fabric Attach (FA) Server receives an FAType Length Value (TLV) from an Access Device running as a FA proxy orclient The Access Device is configured to mirror traffic to a RemoteSwitch Port Analyzer (RSPAN) Virtual Local Area Network (VLAN). The TLVincludes a request to associate the RSPAN VLAN with a Service Identifier(I-SID) used to carry mirror traffic in a network. The method includeswherein the FA server receives the mirrored traffic on the RSPAN VLAN.The method further includes wherein the FA Server signals the I-SID intothe network, and detects receive interest in the I-SID. The methodadditionally includes wherein the FA Server delivers the mirroredtraffic to devices that expressed a receive interest in the mirroredtraffic.

Other embodiments include a computer readable medium having computerreadable code thereon for automated mirroring. The computer readablemedium includes instructions for a Network Device running as a FabricAttach (FA) Server which receives an FA Type Length Value (TLV) from anAccess Device running as a FA proxy or client The Access Device isconfigured to mirror traffic to a Remote Switch Port Analyzer (RSPAN)Virtual Local Area Network (VLAN). The TLV includes a request toassociate the RSPAN VLAN with a Service Identifier (I-SID) used to carrymirror traffic in a network. The computer readable medium also includesinstructions wherein the FA server receives the mirrored traffic on theRSPAN VLAN. The computer readable medium further includes instructionswherein the FA Server signals the I-SID into the network, and alsodetects receive interest in the I-SID. The computer readable mediumadditionally includes instructions wherein the FA Server delivers themirrored traffic to devices that expressed a receive interest in themirrored traffic.

Still other embodiments include a computerized device, configured toprocess all the method operations disclosed herein as embodiments of theinvention. In such embodiments, the computerized device includes amemory system, a processor, communications interface in aninterconnection mechanism connecting these components. The memory systemis encoded with a process for automated mirroring and RSPAN/ERSPANfunctions using FA signaling as explained herein that when performed(e.g. when executing) on the processor, operates as explained hereinwithin the computerized device to perform all of the method embodimentsand operations explained herein as embodiments of the invention. Thusany computerized device that performs or is programmed to perform theprocessing explained herein is an embodiment of the invention.

Other arrangements of embodiments of the invention that are disclosedherein include software programs to perform the method embodiment stepsand operations summarized above and disclosed in detail below. Moreparticularly, a computer program product is one embodiment that has acomputer-readable medium including computer program logic encodedthereon that when performed in a computerized device provides associatedoperations for automated mirroring and RSPAN/ERSPAN functions using FAsignaling as explained herein. The computer program logic, when executedon at least one processor with a computing system, causes the processorto perform the operations (e.g., the methods) indicated herein asembodiments of the invention. Such arrangements of the invention aretypically provided as software, code and/or other data structuresarranged or encoded on a computer readable medium such as an opticalmedium (e.g., CD-ROM), floppy or hard disk or other a medium such asfirmware or microcode in one or more ROM or RAM or PROM chips or as anApplication Specific Integrated Circuit (ASIC) or as downloadablesoftware images in one or more modules, shared libraries, etc. Thesoftware or firmware or other such configurations can be installed ontoa computerized device to cause one or more processors in thecomputerized device to perform the techniques explained herein asembodiments of the invention. Software processes that operate in acollection of computerized devices, such as in a group of datacommunications devices or other entities can also provide the system ofthe invention. The system of the invention can be distributed betweenmany software processes on several data communications devices, or allprocesses could run on a small set of dedicated computers, or on onecomputer alone.

It is to be understood that the embodiments of the invention can beembodied strictly as a software program, as software and hardware, or ashardware and/or circuitry alone, such as within a data communicationsdevice. The features of the invention, as explained herein, may beemployed in data communications devices and/or software systems for suchdevices such as those manufactured by Avaya, Inc. of Basking Ridge, N.J.

Note that each of the different features, techniques, configurations,etc. discussed in this disclosure can be executed independently or incombination. Accordingly, the present invention can be embodied andviewed in many different ways. Also, note that this summary sectionherein does not specify every embodiment and/or incrementally novelaspect of the present disclosure or claimed invention. Instead, thissummary only provides a preliminary discussion of different embodimentsand corresponding points of novelty over conventional techniques. Foradditional details, elements, and/or possible perspectives(permutations) of the invention, the reader is directed to the DetailedDescription section and corresponding figures of the present disclosureas further discussed below.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing will be apparent from the following more particulardescription of preferred embodiments of the invention, as illustrated inthe accompanying drawings in which like reference characters refer tothe same parts throughout the different views. The drawings are notnecessarily to scale, emphasis instead being placed upon illustratingthe principles of the invention. The drawings are not necessarily toscale, emphasis instead being placed upon illustrating the principles ofthe invention.

FIG. 1 depicts a block diagram of a first environment for automatedmirroring and RSPAN/ERSPAN functions using FA signaling in accordancewith a particular embodiment of the present invention.

FIG. 2 depicts a flow diagram of a particular embodiment of a method forautomated mirroring and RSPAN/ERSPAN functions using FA signaling inaccordance with a particular embodiment of the present invention.

FIG. 3 depicts a block diagram of a network device performing automatedmirroring and RSPAN/ERSPAN functions using FA signaling (referred to asMirroring Using FA Signaling in the Figure) in accordance with aparticular embodiment of the present invention.

DETAILED DESCRIPTION

The embodiments set forth below represent the necessary information toenable those skilled in the art to practice the invention and illustratethe best mode of practicing embodiments of the invention. Upon readingthe following description in light of the accompanying figures, thoseskilled in the art will understand the concepts of the invention andrecognize applications of these concepts not particularly addressedherein. It should be understood that these concepts and applicationsfall within the scope of the disclosure and the accompanying claims.

The preferred embodiment of the invention will now be described withreference to the accompanying drawings. The invention may, however, beembodied in many different forms and should not be construed as limitedto the embodiment set forth herein; rather, this embodiment is providedso that this disclosure will be thorough and complete, and will fullyconvey the scope of the invention to those skilled in the art. Theterminology used in the detailed description of the particularembodiment illustrated in the accompanying drawings is not intended tobe limiting of the invention. In the drawings, like numbers refer tolike elements.

The present invention allows an access device requesting traffic comingfrom it to a core switch be mirrored. Each of the access devicerequesting traffic coming from it be mirrored and the device receivingthe mirrored traffic can be deployed independent of the other.

For the case where an access device requesting traffic coming from it toa core switch be mirrored, the process is as follows. The access devicethat is configured to mirror traffic to an RSPAN VLAN issues an FA TypeLength Value (TLV) on its uplink to the server. The TLV includes arequest to associate an RSPAN VLAN with an (Service Identifier) I-SIDthat is used to carry the mirror traffic in the SPB Network. The accessdevice also sends the mirrored traffic on the RSPAN VLAN on its uplinkto the server (normal RSPAN operation). The FA Server signals the I-SIDinto the SPBM Network. When the SPBM Network (including the FA Server)see receive interest in the I-SID (expressed via standard SPB protocolmechanisms)—mirrored traffic gets delivered to the Egress BEBs thatexpressed a receive interest in the stream.

Referring now to FIG. 1, a mirroring environment 10 is shown. A ShortestPath Bridging (SPB) network 12 includes a plurality of Backbone EdgeBridges (BEB-1, BEB-2, and BEB-3) and a plurality of Backbone CoreBridges (BCB-1, BCB-2, BCB-3, and BCB-4), also referred to simply asnetwork devices. A source communicates with the SBP network 12 by way ofCustomer Equipment (CE1). A destination is in communication with SPBNetwork 12 by way of CE2. A monitor communicates with the SPB network 12by way of CE3.

The access device CE1 is configured to mirror traffic to an RSPAN VLANand issues an FA Type Length Value (TLV) on its uplink to the FA server(BEB-1). The TLV includes a request to associate an RSPAN VLAN with an(Service Identifier) I-SID that is used to carry the mirror traffic inthe SPB Network. The access device also sends the mirrored traffic onthe RSPAN VLAN on its uplink to the server (normal RSPAN operation). TheFA Server (BEB-1) signals the I-SID into the SPB Network 12. When theSPBM Network (including the FA Server) see receive interest in the I-SID(expressed via standard SPB protocol mechanisms)—mirrored traffic getsdelivered to the Egress BEBs (BEB-3) that expressed a receive interestin the stream. The normal data goes through BEB-1, to BCB-1, to BCB-3,to BEB-2, to CE2 and to the destination. The mirrored traffic, by way ofthe FA signaling, goes through BEB-1, to BCB-2, to BEB-3, to CE3 and tothe monitor.

A couple of enhancements can also be made to the FA signaling to make itmore applicable to a mirroring application. Mirroring typically involvestraffic going from a point that is being mirrored to the destination(s)that are recipients of the mirror traffic. With the current FA TLVs—whena request is sent it is treated as a request to both transmit andreceive operation. Mirroring needs to transmit or receive but not bothon the same port. One enhancement is to add TX and RX bit definitions tothe current FA I-SID assignment TLVs. This could be accomplished byusing the reserved bits in the currently defined TLVs, or a new TLV canbe used.

A flow chart of the presently disclosed method is depicted in FIG. 2.The rectangular elements are herein denoted “processing blocks” andrepresent computer software instructions or groups of instructions.Alternatively, the processing blocks represent steps performed byfunctionally equivalent circuits such as a digital signal processorcircuit or an application specific integrated circuit (ASIC). The flowdiagrams do not depict the syntax of any particular programminglanguage. Rather, the flow diagrams illustrate the functionalinformation one of ordinary skill in the art requires to fabricatecircuits or to generate computer software to perform the processingrequired in accordance with the present invention. It should be notedthat many routine program elements, such as initialization of loops andvariables and the use of temporary variables are not shown. It will beappreciated by those of ordinary skill in the art that unless otherwiseindicated herein, the particular sequence of steps described isillustrative only and can be varied without departing from the spirit ofthe invention. Thus, unless otherwise stated the steps described beloware unordered meaning that, when possible, the steps can be performed inany convenient or desirable order.

The method 100 begins with processing block 110 which disclosesreceiving, on a Network Device running as a Fabric Attach (FA) Server,an FA Type Length Value (TLV) from an Access Device running as a FAproxy or client, the Access Device is configured to mirror traffic to aRemote Switch Port Analyzer (RSPAN) Virtual Local Area Network (VLAN),wherein the TLV includes a request to associate the RSPAN VLAN with aService Identifier (I-SID) used to carry mirror traffic in a network;

Processing block 112 states wherein the FA TLV includes at least one ofa transmit (TX) bit and a Receive (RX) bit. Processing block 114 recitesat least one of a transmit (TX) bit and a Receive (RX) bit use at leastone reserved bit in a currently defined TLV. Alternately, as shown inprocessing block 116 at least one of a transmit (TX) bit and a Receive(RX) bit are part of a newly defined TLV. Processing block 118 recitesonly one of said Transmit (TX) bit and said Receive (RX) bit are activeat a same time. As further shown in processing block 120, the RSPANcomprises an Encapsulated Remote Switch Port Analyzer (ERSPAN).Processing block 122 discloses the TLV includes a request to associatethe RSPAN VLAN with a Service Identifier (I-SID) used to carry mirrortraffic in a network. As shown in processing block 124, the networkcomprises a Shortest Path Bridging (SPB) network.

Processing block 126 states receiving, by the FA server, the mirroredtraffic on the RSPAN VLAN. Processing block 128 recites signaling, bythe FA server, the I-SID into the network. Processing block 130discloses detecting, by the FA server, receive interest in the I-SID,and processing block 132 shows delivering, by the FA server, themirrored traffic to devices that expressed a receive interest in themirrored traffic.

FIG. 3 is a block diagram 200 illustrating example architecture of annetwork device 210 that executes, runs, interprets, operates orotherwise performs a process for automated mirroring and RSPAN/ERSPANfunctions using FA signaling application 240-1 and automated mirroringand RSPAN/ERSPAN functions using FA signaling operating process 240-2suitable for use in explaining example configurations disclosed herein.As shown in this example, the network device 210 includes aninterconnection mechanism 211 such as a data bus or other circuitry thatcouples a memory system 212, a processor 213, an input/output interface214, and a communications interface 215. The communications interface215 enables the AA server 210 to communicate with other devices (i.e.,other computers) on a network (not shown).

The memory system 212 is any type of computer readable medium, and inthis example, is encoded with an automated mirroring and RSPAN/ERSPANfunctions using FA signaling operating application 240-1 as explainedherein. The automated mirroring and RSPAN/ERSPAN functions using FAsignaling operating application 240-1 may be embodied as software codesuch as data and/or logic instructions (e.g., code stored in the memoryor on another computer readable medium such as a removable disk) thatsupports processing functionality according to different embodimentsdescribed herein. During operation of the network device 310, theprocessor 213 accesses the memory system 212 via the interconnect 211 inorder to launch, run, execute, interpret or otherwise perform the logicinstructions of an automated mirroring and RSPAN/ERSPAN functions usingFA signaling operating application 240-1. Execution of an automatedmirroring and RSPAN/ERSPAN functions using FA signaling operatingapplication 240-1 in this manner produces processing functionality inthe automated mirroring and RSPAN/ERSPAN functions using FA signalingoperating process 240-2. In other words, automated mirroring andRSPAN/ERSPAN functions using FA signaling operating process 240-2represents one or more portions or runtime instances of an automatedmirroring and RSPAN/ERSPAN functions using FA signaling operatingapplication 240-1 (or the entire automated mirroring and RSPAN/ERSPANfunctions using FA signaling operating application 240-1) performing orexecuting within or upon the processor 213 in the network device 210 atruntime.

It is noted that example configurations disclosed herein include theautomated mirroring and RSPAN/ERSPAN functions using FA signalingoperating application 240-1 itself (i.e., in the form of un-executed ornon-performing logic instructions and/or data). The automated mirroringand RSPAN/ERSPAN functions using FA signaling operating application240-1 may be stored on a computer readable medium (such as a floppydisk), hard disk, electronic, magnetic, optical, or other computerreadable medium. An automated mirroring and RSPAN/ERSPAN functions usingFA signaling operating application 240-1 may also be stored in a memorysystem 212 such as in firmware, read only memory (ROM), or, as in thisexample, as executable code in, for example, Random Access Memory (RAM).In addition to these embodiments, it should also be noted that otherembodiments herein include the execution of an automated mirroring andRSPAN/ERSPAN functions using FA signaling operating application 240-1 inthe processor 213 as the automated mirroring and RSPAN/ERSPAN functionsusing FA signaling operating process 240-2. Those skilled in the artwill understand that the network device 210 may include other processesand/or software and hardware components, such as an operating system notshown in this example.

During operation, processor 213 of network device 200 accesses memorysystem 212 via the interconnect 211 in order to launch, run, execute,interpret or otherwise perform the logic instructions of the automatedmirroring and RSPAN/ERSPAN functions using FA signaling application240-1. Execution of debugging automated mirroring and RSPAN/ERSPANfunctions using FA signaling application 240-1 produces processingfunctionality in automated mirroring and RSPAN/ERSPAN functions using FAsignaling process 240-2. In other words, the automated mirroring andRSPAN/ERSPAN functions using FA signaling process 240-2 represents oneor more portions of the automated mirroring and RSPAN/ERSPAN functionsusing FA signaling application 240-1 (or the entire application)performing within or upon the processor 213 in the computer system 200.

It should be noted that, in addition to the automated mirroring andRSPAN/ERSPAN functions using FA signaling process 240-2, embodimentsherein include the automated mirroring and RSPAN/ERSPAN functions usingFA signaling application 240-1 itself (i.e., the un-executed ornon-performing logic instructions and/or data). The automated mirroringand RSPAN/ERSPAN functions using FA signaling application 240-1 can bestored on a computer readable medium such as a floppy disk, hard disk,or optical medium. The automated mirroring and RSPAN/ERSPAN functionsusing FA signaling application 240-1 can also be stored in a memory typesystem such as in firmware, read only memory (ROM), or, as in thisexample, as executable code within the memory system 212 (e.g., withinRandom Access Memory or RAM).

In addition to these embodiments, it should also be noted that otherembodiments herein include the execution of automated mirroring andRSPAN/ERSPAN functions using FA signaling application 240-1 in processor213 as the automated mirroring and RSPAN/ERSPAN functions using FAsignaling process 240-2. Those skilled in the art will understand thatthe computer system 200 can include other processes and/or software andhardware components, such as an operating system that controlsallocation and use of hardware resources associated with the computersystem 200.

The device(s) or computer systems that integrate with the processor(s)may include, for example, a personal computer(s), workstation(s) (e.g.,Sun, HP), personal digital assistant(s) (PDA(s)), handheld device(s)such as cellular telephone(s), laptop(s), handheld computer(s), oranother device(s) capable of being integrated with a processor(s) thatmay operate as provided herein. Accordingly, the devices provided hereinare not exhaustive and are provided for illustration and not limitation.

References to “a microprocessor” and “a processor”, or “themicroprocessor” and “the processor,” may be understood to include one ormore microprocessors that may communicate in a stand-alone and/or adistributed environment(s), and may thus be configured to communicatevia wired or wireless communications with other processors, where suchone or more processor may be configured to operate on one or moreprocessor-controlled devices that may be similar or different devices.Use of such “microprocessor” or “processor” terminology may thus also beunderstood to include a central processing unit, an arithmetic logicunit, an application-specific integrated circuit (IC), and/or a taskengine, with such examples provided for illustration and not limitation.

Furthermore, references to memory, unless otherwise specified, mayinclude one or more processor-readable and accessible memory elementsand/or components that may be internal to the processor-controlleddevice, external to the processor-controlled device, and/or may beaccessed via a wired or wireless network using a variety ofcommunications protocols, and unless otherwise specified, may bearranged to include a combination of external and internal memorydevices, where such memory may be contiguous and/or partitioned based onthe application. Accordingly, references to a database may be understoodto include one or more memory associations, where such references mayinclude commercially available database products (e.g., SQL, Informix,Oracle) and also proprietary databases, and may also include otherstructures for associating memory such as links, queues, graphs, trees,with such structures provided for illustration and not limitation.

References to a network, unless provided otherwise, may include one ormore intranets and/or the internet, as well as a virtual network.References herein to microprocessor instructions ormicroprocessor-executable instructions, in accordance with the above,may be understood to include programmable hardware.

Unless otherwise stated, use of the word “substantially” may beconstrued to include a precise relationship, condition, arrangement,orientation, and/or other characteristic, and deviations thereof asunderstood by one of ordinary skill in the art, to the extent that suchdeviations do not materially affect the disclosed methods and systems.

Throughout the entirety of the present disclosure, use of the articles“a” or “an” to modify a noun may be understood to be used forconvenience and to include one, or more than one of the modified noun,unless otherwise specifically stated.

Elements, components, modules, and/or parts thereof that are describedand/or otherwise portrayed through the figures to communicate with, beassociated with, and/or be based on, something else, may be understoodto so communicate, be associated with, and or be based on in a directand/or indirect manner, unless otherwise stipulated herein.

Although the methods and systems have been described relative to aspecific embodiment thereof, they are not so limited. Obviously manymodifications and variations may become apparent in light of the aboveteachings. Many additional changes in the details, materials, andarrangement of parts, herein described and illustrated, may be made bythose skilled in the art.

Having described preferred embodiments of the invention it will nowbecome apparent to those of ordinary skill in the art that otherembodiments incorporating these concepts may be used. Additionally, thesoftware included as part of the invention may be embodied in a computerprogram product that includes a computer useable medium. For example,such a computer usable medium can include a readable memory device, suchas a hard drive device, a CD-ROM, a DVD-ROM, or a computer diskette,having computer readable program code segments stored thereon. Thecomputer readable medium can also include a communications link, eitheroptical, wired, or wireless, having program code segments carriedthereon as digital or analog signals. Accordingly, it is submitted thatthat the invention should not be limited to the described embodimentsbut rather should be limited only by the spirit and scope of theappended claims.

What is claimed is:
 1. A computer-implemented method comprising:receiving, on a Network Device running as a Fabric Attach (FA) Server,an FA Type Length Value (TLV) from an Access Device running as a FAproxy or client, the Access Device configured to mirror traffic to aRemote Switch Port Analyzer (RSPAN) Virtual Local Area Network (VLAN),wherein the TLV includes a request to associate the RSPAN VLAN with aService Identifier (I-SID) used to carry mirror traffic in a network;receiving, by said FA server, the mirrored traffic on the RSPAN VLAN;signaling, by said FA server, the I-SID into the network; detecting, bysaid FA server, receive interest in the I-SID; and delivering, by saidFA server, the mirrored traffic to devices that expressed a receiveinterest in the mirrored traffic.
 2. The method of claim 1 wherein saidFA TLV includes at least one of a transmit (TX) bit and a Receive (RX)bit.
 3. The method of claim 2 wherein said at least one of a transmit(TX) bit and a Receive (RX) bit use at least one reserved bit in acurrently defined TLV.
 4. The method of claim 2 wherein said at leastone of a transmit (TX) bit and a Receive (RX) bit are part of a newlydefined TLV.
 5. The method of claim 2 wherein only one of said Transmit(TX) bit and said Receive (RX) bit are active at a same time.
 6. Themethod of claim 1 wherein said RSPAN comprises an Encapsulated RemoteSwitch Port Analyzer (ERSPAN).
 7. The method of claim 1 wherein saidnetwork comprises a Shortest Path Bridging (SPB) network.
 8. Anon-transitory computer readable storage medium having computer readablecode thereon for automated mirroring and Remote Switch Port Analyzer(RSPAN)/Encapsulated Remote Switch Port Analyzer (ERSPAN) functionsusing Fabric Attach (FA) Signaling, the medium including instructions inwhich a computer system performs operations comprising: receiving, on aNetwork Device running as a Fabric Attach (FA) Server, an FA Type LengthValue (TLV) from an Access Device running as a FA proxy or client, theAccess Device configured to mirror traffic to a Remote Switch PortAnalyzer (RSPAN) Virtual Local Area Network (VLAN), wherein the TLVincludes a request to associate the RSPAN VLAN with a Service Identifier(I-SID) used to carry mirror traffic in a network; receiving, by said FAserver, the mirrored traffic on the RSPAN VLAN; signaling, by said FAserver, the I-SID into the network; detecting, by said FA server,receive interest in the I-SID; and delivering, by said FA server, themirrored traffic to devices that expressed a receive interest in themirrored traffic.
 9. The computer readable storage medium of claim 8wherein said FA TLV includes at least one of a transmit (TX) bit and aReceive (RX) bit.
 10. The computer readable storage medium of claim 9wherein said at least one of a transmit (TX) bit and a Receive (RX) bituse at least one reserved bit in a currently defined TLV.
 11. Thecomputer readable storage medium of claim 9 wherein said at least one ofa transmit (TX) bit and a Receive (RX) bit are part of a newly definedTLV.
 12. The computer readable storage medium of claim 9 wherein onlyone of said Transmit (TX) bit and said Receive (RX) bit are active at asame time.
 13. The computer readable storage medium of claim 8 whereinsaid RSPAN comprises an Encapsulated Remote Switch Port Analyzer(ERSPAN).
 14. The computer readable storage medium of claim 8 whereinsaid network comprises a Shortest Path Bridging (SPB) network.
 15. Anetwork device comprising: a memory; a processor; a communicationsinterface; an interconnection mechanism coupling the memory, theprocessor and the communications interface; and wherein the memory isencoded with an application providing automated mirroring and RemoteSwitch Port Analyzer (RSPAN)/Encapsulated Remote Switch Port Analyzer(ERSPAN) functions using Fabric Attach (FA) Signaling, that whenperformed on the processor, provides a process for processinginformation, the process causing the network device to perform theoperations of: receiving, on a Network Device running as a Fabric Attach(FA) Server, an FA Type Length Value (TLV) from an Access Device runningas a FA proxy or client, the Access Device configured to mirror trafficto a Remote Switch Port Analyzer (RSPAN) Virtual Local Area Network(VLAN), wherein the TLV includes a request to associate the RSPAN VLANwith a Service Identifier (I-SID) used to carry mirror traffic in anetwork; receiving, by said FA server, the mirrored traffic on the RSPANVLAN; signaling, by said FA server, the I-SID into the network;detecting, by said FA server, receive interest in the I-SID; anddelivering, by said FA server, the mirrored traffic to devices thatexpressed a receive interest in the mirrored traffic.
 16. The networkdevice of claim 15 wherein said FA TLV includes at least one of atransmit (TX) bit and a Receive (RX) bit.
 17. The network device ofclaim 16 wherein said at least one of a transmit (TX) bit and a Receive(RX) bit use at least one reserved bit in a currently defined TLV. 18.The network device of claim 16 wherein said at least one of a transmit(TX) bit and a Receive (RX) bit are part of a newly defined TLV.
 19. Thenetwork device of claim 16 wherein only one of said Transmit (TX) bitand said Receive (RX) bit are active at a same time.
 20. The networkdevice of claim 15 wherein said RSPAN comprises an Encapsulated RemoteSwitch Port Analyzer (ERSPAN).